id: locky-ransomware-hash
info:
  name: Locky Ransomware Hash - Detect
  author: pussycat0x
  severity: info
  description: |
    Detects Locky Ransomware (matches also on Win32/Kuluoz)
  reference:
    - https://goo.gl/qScSrE
    - https://github.com/Yara-Rules/rules/blob/master/malware/RANSOM_Locky.yar
  tags: ransomware,malware

file:
  - extensions:
      - all

    matchers:
      - type: dsl
        dsl:
          - "sha256(raw) == '5e945c1d27c9ad77a2b63ae10af46aee7d29a6a43605a9bfbf35cebbcff184d8'"
# digest: 490a0046304402205302c66b95d066ed9cdc9d92c33deb5f2d674759f72d1ac5dfc687b47623b2b40220008fa3589f8df52fabb50eb4c2625e78c5b287edbe1d594de5306e78e162159b:922c64590222798bb761d5b6d8e72950